d56c66378e737365c911b8e7d5c1dcf610199d78e825ae97ea278eed45661b1d

Sharing

Copy URL Twitter E-mail

General

Target

d56c66378e737365c911b8e7d5c1dcf610199d78e825ae97ea278eed45661b1d
Size

174KB
MD5

344e94da1c05f66844e3059514295906
SHA1

1faea03a126b22a693cac7ede3efdf8ef408db20
SHA256

d56c66378e737365c911b8e7d5c1dcf610199d78e825ae97ea278eed45661b1d
SHA512

3339a16339b647f7337dba5171977937b182cf0cc554c056f25d813b3a8eda69e0fafd72a008b625f9d2d703f170390e38037aabb9c4b29799374eb2b344a32b
SSDEEP

3072:am0Gvtt9MDIZRA1SA1kYxQ9sSev5oYe7f3gea6NsPXVLiAR:amhv3WoA1Pe7se7f/KvHR

Score

N/A

Malware Config

Signatures

Files

d56c66378e737365c911b8e7d5c1dcf610199d78e825ae97ea278eed45661b1d
.dll windows x86

b0d5e8a0c5e2bc8766f115b2056b9786

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

1b:86:12:67:7a:e1:9d
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

14/10/2007, 22:03

Not After

14/10/2022, 22:03

Subject

CN=StartCom Class 3 Primary Intermediate Object CA,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:bf:f1:b8:5c:2c:da
Certificate

Issuer

CN=StartCom Class 3 Primary Intermediate Object CA,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

01/06/2015, 04:53

Not After

31/05/2018, 10:05

Subject

CN=The Document Foundation,O=The Document Foundation,L=Berlin,ST=Berlin,C=DE,1.2.840.113549.1.9.1=#0c1b696e666f40646f63756d656e74666f756e646174696f6e2e6f7267

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftKernelCodeSigning

Key Usages

KeyUsageDigitalSignature

bb:ed:51:92:97:51:85:00:b6:2e:cf:21:0e:29:29:5b:bf:2a:fe:ac
Signer

Actual PE Digest

bb:ed:51:92:97:51:85:00:b6:2e:cf:21:0e:29:29:5b:bf:2a:fe:ac

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=The Document Foundation,O=The Document Foundation,L=Berlin,ST=Berlin,C=DE,1.2.840.113549.1.9.1=#0c1b696e666f40646f63756d656e74666f756e646174696f6e2e6f7267

20/07/2016, 17:46
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

sqlite3

sqlite3_file_control
sqlite3_reset
sqlite3_finalize
sqlite3_column_int
sqlite3_column_bytes
sqlite3_column_blob
sqlite3_step
sqlite3_bind_text
sqlite3_bind_int
sqlite3_bind_blob
sqlite3_prepare_v2
sqlite3_open
sqlite3_free
sqlite3_mprintf
sqlite3_busy_timeout
sqlite3_exec
sqlite3_close

nssutil3

SEC_ASN1EncodeInteger_Util
NSSUTIL_ArgDecodeNumber
NSSUTIL_ArgIsBlank
NSSUTIL_ArgHasFlag
SECITEM_CompareItem_Util
PORT_FreeArena_Util
PORT_Alloc_Util
PORT_Free_Util
NSSUTIL_ArgSkipParameter
NSS_Get_SECOID_AlgorithmIDTemplate_Util
NSS_Get_SEC_AnyTemplate_Util
NSS_Get_SEC_BitStringTemplate_Util
NSS_Get_SEC_ObjectIDTemplate_Util
PORT_NewArena_Util
PORT_ArenaZAlloc_Util
SECITEM_CopyItem_Util
PORT_ZAlloc_Util
NSSUTIL_ArgStrip
DER_GetInteger_Util
NSSUTIL_ArgFetchValue
_NSSUTIL_EvaluateConfigDir
PORT_Strdup_Util
SECOID_FindOIDByMechanism
SGN_DestroyDigestInfo_Util
SGN_CreateDigestInfo_Util
DER_Encode_Util
_SGN_VerifyPKCS1DigestInfo
NSS_Get_SEC_OctetStringTemplate_Util
SEC_QuickDERDecodeItem_Util
_NSSUTIL_GetSecmodName
NSSUTIL_DoModuleDBFunction
UTIL_SetForkState
SECOID_Shutdown
SECOID_Init
DER_SetUInteger
SECITEM_HashCompare
PORT_ArenaAlloc_Util
PORT_GetError_Util
PORT_ArenaGrow_Util
PORT_Realloc_Util
SECOID_DestroyAlgorithmID_Util
SECOID_GetAlgorithmTag_Util
SECOID_CopyAlgorithmID_Util
SECOID_SetAlgorithmID_Util
PORT_SetError_Util
SEC_ASN1EncodeItem_Util
SEC_ASN1DecodeItem_Util
SECITEM_ZfreeItem_Util
SECITEM_FreeItem_Util
SECITEM_DupItem_Util
SECITEM_AllocItem_Util
PORT_ZFree_Util
NSSUTIL_ArgGetLabel

plc4

PL_strncasecmp
PL_strcasecmp

plds4

PL_HashTableRemove
PL_HashTableLookupConst
PL_HashTableDestroy
PL_NewHashTable
PL_CompareValues
PL_HashTableEnumerateEntries
PL_HashTableAdd
PL_HashTableLookup

nspr4

PR_GetEnvSecure
PR_CallOnce
PR_SetError
PR_Free
PR_smprintf
PR_ExitMonitor
PR_EnterMonitor
PR_DestroyMonitor
PR_NewMonitor
PR_Access
PR_Now
PR_GetCurrentThread
PR_MillisecondsToInterval
PR_IntervalNow
PR_smprintf_free
PR_Sleep
PR_DestroyLock
PR_NewLock
PR_SecondsToInterval
PR_GetDirectorySeparator
PR_Unlock
PR_Lock
PR_GetLibraryFilePathname
PR_FindFunctionSymbol
PR_UnloadLibrary
PR_LoadLibraryWithFlags
PR_snprintf

msvcr120

_chmod
_except_handler4_common
__clean_type_info_names_internal
_onexit
__dllonexit
_calloc_crt
_unlock
_initterm_e
_initterm
_malloc_crt
_amsg_exit
__CppXcptFilter
__crtTerminateProcess
__crtUnhandledException
_crt_debugger_hook
malloc
free
sprintf
memcpy
strrchr
atoi
isdigit
islower
isupper
memset
_lock

kernel32

QueryPerformanceCounter
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
GetTempPathA
DecodePointer
EncodePointer
IsProcessorFeaturePresent
IsDebuggerPresent

Exports

Exports

C_GetFunctionList
FC_GetFunctionList
NSC_GetFunctionList
NSC_ModuleDBFunc

Sections

.text
Size: 138KB - Virtual size: 137KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b0d5e8a0c5e2bc8766f115b2056b9786

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14Certificate

Extended Key Usages

Key Usages

1b:86:12:67:7a:e1:9dCertificate

Key Usages

11:bf:f1:b8:5c:2c:daCertificate

Extended Key Usages

Key Usages

bb:ed:51:92:97:51:85:00:b6:2e:cf:21:0e:29:29:5b:bf:2a:fe:acSigner

Signature Validations

Verification

20/07/2016, 17:46 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

sqlite3

nssutil3

plc4

plds4

nspr4

msvcr120

kernel32

Exports

Exports

Sections

.text Size: 138KB - Virtual size: 137KB

.rdata Size: 20KB - Virtual size: 19KB

.data Size: 1024B - Virtual size: 1KB

.rsrc Size: 1024B - Virtual size: 816B

.reloc Size: 6KB - Virtual size: 6KB

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

1b:86:12:67:7a:e1:9d
Certificate

11:bf:f1:b8:5c:2c:da
Certificate

bb:ed:51:92:97:51:85:00:b6:2e:cf:21:0e:29:29:5b:bf:2a:fe:ac
Signer

20/07/2016, 17:46
Valid: false

.text
Size: 138KB - Virtual size: 137KB

.rdata
Size: 20KB - Virtual size: 19KB

.data
Size: 1024B - Virtual size: 1KB

.rsrc
Size: 1024B - Virtual size: 816B

.reloc
Size: 6KB - Virtual size: 6KB